Request a second opinion

Privacy Policy
Version: October 2026

This English version is a courtesy translation provided for convenience. Only the German version is legally binding.

Thank you for your interest in our company. The protection of your data is our highest priority. In general, you can use our website second-view.eu without providing any personal data. However, if you wish to use certain services via our website, it may be necessary for us to process personal data. In cases where there is no legal basis for such processing, we always obtain your express consent in advance.

1. Controller pursuant to Art. 4 No. 7 GDPR

Q-Rad GmbH, represented by Dr. med. Igor Toker
E-mail: igor.toker@q-rad.de

2. Structure of our services

Second-View.eu consists of two separate areas:

Medical data is processed exclusively in Germany.

3. Purposes of data processing

We process your data for the following purposes:

4. Legal bases for processing

Processing is carried out on the basis of:

Art. 6 (1) (b) GDPR

Performance of (pre-)contractual services in connection with the medical second opinion.

Art. 6 (1) (a) GDPR & Art. 9 (2) (a) GDPR

Express consent to the processing of medical data.

Art. 6 (1) (f) GDPR

Legitimate interest in

- the secure provision of the platform,

- statistical analysis of how the website and portal are used, so we can improve our service and judge how well our advertising works (Section 6.5), and

- obtaining user feedback for quality assurance and improvement of our services (satisfaction surveys after case completion, where applicable an invitation to submit a public review).

We send feedback requests exclusively to users after completion of their case. You can object to this processing at any time with effect for the future (Art. 21 GDPR) — informally, by e-mail to the address stated in Section 1. After an objection, we will not send you any further feedback requests.

Art. 9 (3) GDPR

Processing by members of a health profession subject to professional secrecy (specialist physicians).

Consent may be withdrawn at any time (with effect for the future).

5. Categories of data processed

5.1 Contact and communication data

5.2 Medical data (Art. 9 GDPR)

5.3 Payment data

5.4 Feedback and survey data

- information from voluntary satisfaction surveys (ratings, free-text comments)

- e-mail address (for the invitation)

- technical metadata (IP address, user agent, time)
(No health data; participation is voluntary.)

6. Recipients and categories of service providers

Data is shared only to the extent necessary for the service.

6.1 Specialist physicians

Receive medical documents exclusively for the preparation of the second opinion.
Act as independently responsible treating physicians.

6.2 Hetzner (Germany)

Hetzner Online GmbH
Operates:

Processing takes place exclusively in Germany.

6.3 Resend (USA)

E-mail service for notifications.
Processes:

Safeguard: SCCs.
No medical data is transmitted.

6.4 Stripe Payments Europe Ltd. (Ireland) & Stripe Inc. (USA)

Payment processing, including transmission of the payment data required.
Safeguarded by SCCs.

Stripe receives no medical data.

6.5 Audience measurement with Umami (self-hosted)

On this website and in the portal we use the open-source software Umami to analyse usage statistically – for example, which pages are visited and which links or campaigns bring visitors to us. We run Umami ourselves on our server at Hetzner in Germany (analytics.second-view.eu); the data is not shared with third parties.

Umami sets no cookies and stores nothing on your device. It records:

Your IP address is not stored. It is used only briefly to determine your approximate location and to generate an anonymous visit identifier that changes regularly. The data is not linked to you as a person, and no medical data is recorded.

The legal basis is Art. 6 (1) (f) GDPR. You can object to audience measurement at any time (Art. 21 GDPR), for example by blocking the script with a standard tracker or ad blocker.

6.6 Campaign attribution (local storage)

If you reach our website through an ad or a campaign link, we store the campaign parameters in the address (e.g. utm_source, utm_campaign, utm_term and Google Ads' click identifier gclid) and your entry page in your browser's local storage (localStorage) for 30 days. When you move on to the portal, we pass this information along so we can tell which campaign an inquiry came from. It is not sent to Google or any other third party, and no cookies are set.

The legal basis is Art. 6 (1) (f) GDPR (our legitimate interest in judging how well our advertising works). You can delete this information at any time by clearing the site data in your browser; it expires automatically after 30 days.

6.7 Where inquiries come from (server log files)

To understand how inquiries reach us – for example through ads, links on other websites or direct visits – we analyse the server log files of the website and the portal (IP address, time, page requested including campaign parameters, user agent). This is done automatically. All we keep are aggregated counts per source and search term and, for no more than 90 days, the inquiry's reference number together with its source – no IP addresses. The server log files themselves are deleted after 14 days. None of this is shared with third parties.

The legal basis is Art. 6 (1) (f) GDPR (our legitimate interest in judging how well our advertising and information services work).

6.8 Anthropic (Ireland & USA) — AI assistant used by our administration

Our administrators use the AI assistant Claude, provided by Anthropic Ireland, Limited, to handle inquiries faster. Anthropic processes only:

Your name, contact details, your question, medical documents and findings are not transmitted. Anthropic acts as a processor and does not use the data to train AI models. Every action is reviewed and confirmed by an administrator; decisions are always made by a person.

Safeguard: data processing agreement including EU Standard Contractual Clauses (SCCs). The legal basis is Art. 6 (1) (f) GDPR (our legitimate interest in handling your inquiry promptly).

7. Data security

We implement technical and organizational measures pursuant to Art. 32 GDPR, including:

Medical data is stored exclusively in Germany.

8. Retention and deletion

8.1 Storage by the platform (Q-Rad GmbH)

We store medical data only for as long as is necessary for the preparation and provision of the medical second opinion.

After completion of the case:

We are not subject to any statutory medical retention obligation, as we do not provide medical services.

8.2 Retention by the physicians

The consulted specialist physicians are, as treating physicians, obliged to retain their medical documentation (e.g. the second opinion prepared and essential information)
for 10 years (Section 630f of the German Civil Code (BGB)).
This retention does not take place via the platform but in the physician's own medical records.

9. Your rights as a data subject

Under the GDPR, you have the right at any time to:

Supervisory authority for data protection complaints

You may contact any data protection authority, e.g.:

the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)
or the authority of your EU country of residence.

10. Automated decision-making

No automated decision-making or profiling pursuant to Art. 22 GDPR takes place.

11. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy as needed.
The current version is available on the website at any time.